Use npm trusted publishing

.github/workflows/release.yml

@@ -2,7 +2,11 @@ name: Release
 
 on:
   push:
-    tags: ['v*']
+    tags: ["v*.*.*"]
+
+concurrency:
+  group: release-${{ github.ref_name }}
+  cancel-in-progress: false
 
 permissions:
   contents: write
@@ -17,18 +21,26 @@ jobs:
           persist-credentials: false
       - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
         with:
-          node-version: '22'
+          node-version: "24"
           cache: npm
-          registry-url: https://registry.npmjs.org
       - run: npm ci
       - run: npm test
       - name: Check tag and package version
         run: test "${GITHUB_REF_NAME#v}" = "$(node -p "require('./package.json').version")"
-      - run: npm publish --provenance --access public
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+      - name: Publish to npm
+        run: |
+          if npm view "mailschema@${GITHUB_REF_NAME#v}" version >/dev/null 2>&1; then
+            echo "mailschema@${GITHUB_REF_NAME#v} already exists; skipping publish"
+            exit 0
+          fi
+          npm publish --provenance --access public
       - run: npm pack
       - name: Publish GitHub release
-        run: gh release create "$GITHUB_REF_NAME" --generate-notes mailschema-*.tgz
+        run: |
+          if gh release view "$GITHUB_REF_NAME" >/dev/null 2>&1; then
+            echo "$GITHUB_REF_NAME already has a GitHub release"
+            exit 0
+          fi
+          gh release create "$GITHUB_REF_NAME" --generate-notes mailschema-*.tgz
         env:
           GH_TOKEN: ${{ github.token }}